chore: migrate harbor from 2.1.5 to 2.2.2
Sven Ketelsen
5 years ago
parent
8951bd1bb2
commit
26ee698c77
@ -1 +1,3 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
|
harbor_version: v2.2.2
|
||||||
|
|||||||
@ -1,37 +0,0 @@
|
|||||||
## Settings should be set
|
|
||||||
PORT=9999
|
|
||||||
|
|
||||||
# Only support redis now. If redis is setup, then enable cache
|
|
||||||
CACHE=redis
|
|
||||||
CACHE_REDIS_ADDR=redis:6379
|
|
||||||
CACHE_REDIS_PASSWORD=
|
|
||||||
CACHE_REDIS_DB=3
|
|
||||||
|
|
||||||
# Credential for internal communication
|
|
||||||
BASIC_AUTH_USER=chart_controller
|
|
||||||
BASIC_AUTH_PASS=
|
|
||||||
|
|
||||||
# Multiple tenants
|
|
||||||
# Must be set with 1 to support project namespace
|
|
||||||
DEPTH=1
|
|
||||||
|
|
||||||
# Backend storage driver: e.g. "local", "amazon", "google" etc.
|
|
||||||
STORAGE=local
|
|
||||||
# Storage driver settings
|
|
||||||
STORAGE_LOCAL_ROOTDIR=/chart_storage
|
|
||||||
## Settings with default values. Just put here for future changes
|
|
||||||
DEBUG=false
|
|
||||||
LOG_JSON=true
|
|
||||||
DISABLE_METRICS=false
|
|
||||||
DISABLE_API=false
|
|
||||||
DISABLE_STATEFILES=false
|
|
||||||
ALLOW_OVERWRITE=true
|
|
||||||
CHART_URL=
|
|
||||||
AUTH_ANONYMOUS_GET=false
|
|
||||||
CONTEXT_PATH=
|
|
||||||
INDEX_LIMIT=0
|
|
||||||
MAX_STORAGE_OBJECTS=0
|
|
||||||
MAX_UPLOAD_SIZE=20971520
|
|
||||||
CHART_POST_FORM_FIELD_NAME=chart
|
|
||||||
PROV_POST_FORM_FIELD_NAME=prov
|
|
||||||
STORAGE_TIMESTAMP_TOLERANCE=1s
|
|
||||||
@ -1,6 +0,0 @@
|
|||||||
appname = Harbor
|
|
||||||
runmode = prod
|
|
||||||
enablegzip = true
|
|
||||||
|
|
||||||
[prod]
|
|
||||||
httpport = 8080
|
|
||||||
@ -1,50 +0,0 @@
|
|||||||
CONFIG_PATH=/etc/core/app.conf
|
|
||||||
UAA_CA_ROOT=/etc/core/certificates/uaa_ca.pem
|
|
||||||
_REDIS_URL_CORE=redis://redis:6379?idle_timeout_seconds=30
|
|
||||||
SYNC_QUOTA=true
|
|
||||||
CHART_CACHE_DRIVER=redis
|
|
||||||
_REDIS_URL_REG=redis://redis:6379/1?idle_timeout_seconds=30
|
|
||||||
|
|
||||||
LOG_LEVEL=info
|
|
||||||
EXT_ENDPOINT=https://dev-docker-registry-01.smardigo.digital
|
|
||||||
DATABASE_TYPE=postgresql
|
|
||||||
POSTGRESQL_HOST=postgresql
|
|
||||||
POSTGRESQL_PORT=5432
|
|
||||||
POSTGRESQL_USERNAME=postgres
|
|
||||||
POSTGRESQL_PASSWORD={{ harbor_postgresql_password }}
|
|
||||||
POSTGRESQL_DATABASE=registry
|
|
||||||
POSTGRESQL_SSLMODE=disable
|
|
||||||
POSTGRESQL_MAX_IDLE_CONNS=50
|
|
||||||
POSTGRESQL_MAX_OPEN_CONNS=1000
|
|
||||||
REGISTRY_URL=http://registry:5000
|
|
||||||
PORTAL_URL=http://portal:8080
|
|
||||||
TOKEN_SERVICE_URL=http://core:8080/service/token
|
|
||||||
HARBOR_ADMIN_PASSWORD={{ harbor_admin_password }}
|
|
||||||
MAX_JOB_WORKERS=10
|
|
||||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
|
||||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
|
||||||
WITH_NOTARY=False
|
|
||||||
WITH_CLAIR=False
|
|
||||||
WITH_TRIVY=True
|
|
||||||
CORE_URL=http://core:8080
|
|
||||||
CORE_LOCAL_URL=http://127.0.0.1:8080
|
|
||||||
JOBSERVICE_URL=http://jobservice:8080
|
|
||||||
CLAIR_ADAPTER_URL=http://clair-adapter:8080
|
|
||||||
TRIVY_ADAPTER_URL=http://trivy-adapter:8080
|
|
||||||
NOTARY_URL=http://notary-server:4443
|
|
||||||
REGISTRY_STORAGE_PROVIDER_NAME=filesystem
|
|
||||||
READ_ONLY=false
|
|
||||||
RELOAD_KEY=
|
|
||||||
CHART_REPOSITORY_URL=http://chartmuseum:9999
|
|
||||||
REGISTRY_CONTROLLER_URL=http://registryctl:8080
|
|
||||||
WITH_CHARTMUSEUM=True
|
|
||||||
REGISTRY_CREDENTIAL_USERNAME=harbor_registry_user
|
|
||||||
REGISTRY_CREDENTIAL_PASSWORD=spYrLufyLbHrqlAFUPlnijhIFKS3ys1H
|
|
||||||
CSRF_KEY=fNvrK554TPxFnLUUByjumlvirGOQGdRi
|
|
||||||
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE=docker-hub,harbor
|
|
||||||
|
|
||||||
HTTP_PROXY=
|
|
||||||
HTTPS_PROXY=
|
|
||||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
|
||||||
|
|
||||||
PORT=8080
|
|
||||||
@ -1 +0,0 @@
|
|||||||
POSTGRES_PASSWORD={{ harbor_postgresql_password }}
|
|
||||||
@ -1,35 +0,0 @@
|
|||||||
---
|
|
||||||
#Protocol used to serve
|
|
||||||
protocol: "http"
|
|
||||||
|
|
||||||
#Server listening port
|
|
||||||
port: 8080
|
|
||||||
|
|
||||||
#Worker pool
|
|
||||||
worker_pool:
|
|
||||||
#Worker concurrency
|
|
||||||
workers: 10
|
|
||||||
backend: "redis"
|
|
||||||
#Additional config if use 'redis' backend
|
|
||||||
redis_pool:
|
|
||||||
#redis://[arbitrary_username:password@]ipaddress:port/database_index
|
|
||||||
redis_url: redis://redis:6379/2?idle_timeout_seconds=30
|
|
||||||
namespace: "harbor_job_service_namespace"
|
|
||||||
idle_timeout_second: 3600
|
|
||||||
#Loggers for the running job
|
|
||||||
job_loggers:
|
|
||||||
- name: "STD_OUTPUT" # logger backend name, only support "FILE" and "STD_OUTPUT"
|
|
||||||
level: "INFO" # INFO/DEBUG/WARNING/ERROR/FATAL
|
|
||||||
- name: "FILE"
|
|
||||||
level: "INFO"
|
|
||||||
settings: # Customized settings of logger
|
|
||||||
base_dir: "/var/log/jobs"
|
|
||||||
sweeper:
|
|
||||||
duration: 1 #days
|
|
||||||
settings: # Customized settings of sweeper
|
|
||||||
work_dir: "/var/log/jobs"
|
|
||||||
|
|
||||||
#Loggers for the job service
|
|
||||||
loggers:
|
|
||||||
- name: "STD_OUTPUT" # Same with above
|
|
||||||
level: "INFO"
|
|
||||||
@ -1,13 +0,0 @@
|
|||||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
|
||||||
REGISTRY_URL=http://registry:5000
|
|
||||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
|
||||||
CORE_URL=http://core:8080
|
|
||||||
REGISTRY_CONTROLLER_URL=http://registryctl:8080
|
|
||||||
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY=10
|
|
||||||
|
|
||||||
|
|
||||||
HTTP_PROXY=
|
|
||||||
HTTPS_PROXY=
|
|
||||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
|
||||||
REGISTRY_CREDENTIAL_USERNAME=harbor_registry_user
|
|
||||||
REGISTRY_CREDENTIAL_PASSWORD=spYrLufyLbHrqlAFUPlnijhIFKS3ys1H
|
|
||||||
@ -1,8 +0,0 @@
|
|||||||
/var/log/docker/*.log {
|
|
||||||
rotate 50
|
|
||||||
size 200M
|
|
||||||
copytruncate
|
|
||||||
compress
|
|
||||||
missingok
|
|
||||||
nodateext
|
|
||||||
}
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
# Rsyslog configuration file for docker.
|
|
||||||
|
|
||||||
template(name="DynaFile" type="string" string="/var/log/docker/%programname%.log")
|
|
||||||
|
|
||||||
if $programname != "rsyslogd" then {
|
|
||||||
action(type="omfile" dynaFile="DynaFile")
|
|
||||||
}
|
|
||||||
@ -1,137 +0,0 @@
|
|||||||
worker_processes auto;
|
|
||||||
pid /tmp/nginx.pid;
|
|
||||||
|
|
||||||
events {
|
|
||||||
worker_connections 1024;
|
|
||||||
use epoll;
|
|
||||||
multi_accept on;
|
|
||||||
}
|
|
||||||
|
|
||||||
http {
|
|
||||||
client_body_temp_path /tmp/client_body_temp;
|
|
||||||
proxy_temp_path /tmp/proxy_temp;
|
|
||||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
||||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
||||||
scgi_temp_path /tmp/scgi_temp;
|
|
||||||
tcp_nodelay on;
|
|
||||||
|
|
||||||
# this is necessary for us to be able to disable request buffering in all cases
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
|
|
||||||
upstream core {
|
|
||||||
server core:8080;
|
|
||||||
}
|
|
||||||
|
|
||||||
upstream portal {
|
|
||||||
server portal:8080;
|
|
||||||
}
|
|
||||||
|
|
||||||
log_format timed_combined '$remote_addr - '
|
|
||||||
'"$request" $status $body_bytes_sent '
|
|
||||||
'"$http_referer" "$http_user_agent" '
|
|
||||||
'$request_time $upstream_response_time $pipe';
|
|
||||||
|
|
||||||
access_log /dev/stdout timed_combined;
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 8080;
|
|
||||||
server_tokens off;
|
|
||||||
# disable any limits to avoid HTTP 413 for large image uploads
|
|
||||||
client_max_body_size 0;
|
|
||||||
|
|
||||||
# Add extra headers
|
|
||||||
add_header X-Frame-Options DENY;
|
|
||||||
add_header Content-Security-Policy "frame-ancestors 'none'";
|
|
||||||
|
|
||||||
# costumized location config file can place to /etc/nginx/etc with prefix harbor.http. and suffix .conf
|
|
||||||
include /etc/nginx/conf.d/harbor.http.*.conf;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://portal/;
|
|
||||||
# proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /c/ {
|
|
||||||
proxy_pass http://core/c/;
|
|
||||||
# proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /api/ {
|
|
||||||
proxy_pass http://core/api/;
|
|
||||||
# proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /chartrepo/ {
|
|
||||||
proxy_pass http://core/chartrepo/;
|
|
||||||
# proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /v1/ {
|
|
||||||
return 404;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /v2/ {
|
|
||||||
proxy_pass http://core/v2/;
|
|
||||||
# proxy_set_header Host $http_host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
|
|
||||||
proxy_send_timeout 900;
|
|
||||||
proxy_read_timeout 900;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /service/ {
|
|
||||||
proxy_pass http://core/service/;
|
|
||||||
# proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
|
|
||||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /service/notifications {
|
|
||||||
return 404;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
worker_processes auto;
|
|
||||||
pid /tmp/nginx.pid;
|
|
||||||
|
|
||||||
events {
|
|
||||||
worker_connections 1024;
|
|
||||||
}
|
|
||||||
|
|
||||||
http {
|
|
||||||
|
|
||||||
client_body_temp_path /tmp/client_body_temp;
|
|
||||||
proxy_temp_path /tmp/proxy_temp;
|
|
||||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
||||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
||||||
scgi_temp_path /tmp/scgi_temp;
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 8080;
|
|
||||||
server_name localhost;
|
|
||||||
|
|
||||||
root /usr/share/nginx/html;
|
|
||||||
index index.html index.htm;
|
|
||||||
include /etc/nginx/mime.types;
|
|
||||||
|
|
||||||
gzip on;
|
|
||||||
gzip_min_length 1000;
|
|
||||||
gzip_proxied expired no-cache no-store private auth;
|
|
||||||
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
}
|
|
||||||
|
|
||||||
location = /index.html {
|
|
||||||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,36 +0,0 @@
|
|||||||
version: 0.1
|
|
||||||
log:
|
|
||||||
level: info
|
|
||||||
fields:
|
|
||||||
service: registry
|
|
||||||
storage:
|
|
||||||
cache:
|
|
||||||
layerinfo: redis
|
|
||||||
filesystem:
|
|
||||||
rootdirectory: /storage
|
|
||||||
maintenance:
|
|
||||||
uploadpurging:
|
|
||||||
enabled: false
|
|
||||||
delete:
|
|
||||||
enabled: true
|
|
||||||
redis:
|
|
||||||
addr: redis:6379
|
|
||||||
readtimeout: 10s
|
|
||||||
writetimeout: 10s
|
|
||||||
dialtimeout: 10s
|
|
||||||
password:
|
|
||||||
db: 1
|
|
||||||
http:
|
|
||||||
addr: :5000
|
|
||||||
secret: placeholder
|
|
||||||
debug:
|
|
||||||
addr: localhost:5001
|
|
||||||
auth:
|
|
||||||
htpasswd:
|
|
||||||
realm: harbor-registry-basic-realm
|
|
||||||
path: /etc/registry/passwd
|
|
||||||
validation:
|
|
||||||
disabled: true
|
|
||||||
compatibility:
|
|
||||||
schema1:
|
|
||||||
enabled: true
|
|
||||||
@ -1 +0,0 @@
|
|||||||
harbor_registry_user:$2y$05$EE3OyDzK1lhlSFIDIc0HcuMAl2hiwZraRg0yWgnfSfa1459Z5sFey
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
protocol: "http"
|
|
||||||
port: 8080
|
|
||||||
log_level: "INFO"
|
|
||||||
registry_config: "/etc/registry/config.yml"
|
|
||||||
@ -1,2 +0,0 @@
|
|||||||
CORE_SECRET=ydNg7WrBhEcyJuL3
|
|
||||||
JOBSERVICE_SECRET=9fjG7ZiGRpyZ3nX1
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
SCANNER_LOG_LEVEL=info
|
|
||||||
SCANNER_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
|
||||||
SCANNER_STORE_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
|
||||||
SCANNER_STORE_REDIS_NAMESPACE=harbor.scanner.trivy:store
|
|
||||||
SCANNER_JOB_QUEUE_REDIS_URL=redis://redis:6379/5?idle_timeout_seconds=30
|
|
||||||
SCANNER_JOB_QUEUE_REDIS_NAMESPACE=harbor.scanner.trivy:job-queue
|
|
||||||
SCANNER_TRIVY_CACHE_DIR=/home/scanner/.cache/trivy
|
|
||||||
SCANNER_TRIVY_REPORTS_DIR=/home/scanner/.cache/reports
|
|
||||||
SCANNER_TRIVY_VULN_TYPE=os,library
|
|
||||||
SCANNER_TRIVY_SEVERITY=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
|
||||||
SCANNER_TRIVY_IGNORE_UNFIXED=False
|
|
||||||
SCANNER_TRIVY_SKIP_UPDATE=False
|
|
||||||
SCANNER_TRIVY_GITHUB_TOKEN=
|
|
||||||
SCANNER_TRIVY_INSECURE=False
|
|
||||||
HTTP_PROXY=
|
|
||||||
HTTPS_PROXY=
|
|
||||||
NO_PROXY=clair,jobservice,registryctl,core,notary-server,clair-adapter,trivy-adapter,postgresql,chartmuseum,localhost,db,nginx,notary-signer,.internal,portal,log,127.0.0.1,.local,registry,redis
|
|
||||||
Loading…
Reference in New Issue